@intentius/terragucci 0.4.12 → 0.4.13

package/dist/terragucci.schema.json

@@ -64,12 +64,34 @@
       "description": "When a wave waits for an approval. on-destroy is an older name for on-destructive."
     },
     "approval": {
-      "enum": [
-        "ledger",
-        "pr-review",
-        "sealed"
+      "anyOf": [
+        {
+          "enum": [
+            "ledger",
+            "pr-review",
+            "sealed"
+          ]
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "mode": {
+              "enum": [
+                "ledger",
+                "pr-review",
+                "sealed"
+              ],
+              "description": "What counts as a waiting wave's approval."
+            },
+            "require_signed": {
+              "type": "boolean",
+              "description": "Refuse an unsigned approval on the ledger, so every ledger approval is tied to the principal who signed it."
+            }
+          }
+        }
       ],
-      "description": "What counts as a waiting wave's approval."
+      "description": "What counts as a waiting wave's approval: the mode, or a map with the mode and require_signed."
     },
     "apply": {
       "type": "object",
@@ -1127,6 +1149,11 @@
           "type": "string",
           "minLength": 1
         },
+        "login": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*(\\[bot\\])?$",
+          "description": "The forge login agent.token_env's token acts as. No approval by it counts."
+        },
         "comment": {
           "anyOf": [
             {
@@ -1720,12 +1747,34 @@
           "description": "When a wave waits for an approval. on-destroy is an older name for on-destructive."
         },
         "approval": {
-          "enum": [
-            "ledger",
-            "pr-review",
-            "sealed"
+          "anyOf": [
+            {
+              "enum": [
+                "ledger",
+                "pr-review",
+                "sealed"
+              ]
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "mode": {
+                  "enum": [
+                    "ledger",
+                    "pr-review",
+                    "sealed"
+                  ],
+                  "description": "What counts as a waiting wave's approval."
+                },
+                "require_signed": {
+                  "type": "boolean",
+                  "description": "Refuse an unsigned approval on the ledger, so every ledger approval is tied to the principal who signed it."
+                }
+              }
+            }
           ],
-          "description": "What counts as a waiting wave's approval."
+          "description": "What counts as a waiting wave's approval: the mode, or a map with the mode and require_signed."
         },
         "apply": {
           "type": "object",
@@ -2775,6 +2824,11 @@
               "type": "string",
               "minLength": 1
             },
+            "login": {
+              "type": "string",
+              "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*(\\[bot\\])?$",
+              "description": "The forge login agent.token_env's token acts as. No approval by it counts."
+            },
             "comment": {
               "anyOf": [
                 {

package/dist/types.d.ts

@@ -20,6 +20,22 @@ export declare function normalizeGate(v: unknown): Gate | undefined;
  * lists for its approver. Every mode binds the digest.
  */
 export declare const APPROVALS: readonly ["ledger", "pr-review", "sealed"];
+/** The keys of `approval:` as a map: the mode, and whether a ledger approval must be signed. */
+export declare const APPROVAL_KEYS: readonly ["mode", "require_signed"];
+/**
+ * `approval:` as a map, in place of the mode alone. `require_signed: true`
+ * refuses an unsigned approval on the ledger: only a signed one can be tied
+ * to the person whose principal signed it, so only a signed one can be
+ * checked against the people behind the change (./involved.ts).
+ */
+export interface ApprovalSettings {
+    mode?: Approval;
+    require_signed?: boolean;
+}
+/** The mode an `approval:` value names: the string, or the map's `mode`. */
+export declare function approvalModeOf(v: Approval | ApprovalSettings | undefined): Approval | undefined;
+/** Whether an `approval:` value refuses unsigned ledger approvals. */
+export declare function requireSignedOf(v: Approval | ApprovalSettings | undefined): boolean;
 /** Every stage runs on the forge's CI. */
 export declare const RUNTIMES: readonly ["forge"];
 export declare const DEPENDENTS: readonly ["follow", "plan"];
@@ -376,8 +392,8 @@ export interface ProjectSettings {
     url?: string;
     /** When a wave waits for an approval. A loaded config holds the policy's current name: on-destroy reads as on-destructive. */
     gate?: GateName;
-    /** What counts as a waiting wave's approval; see APPROVALS. Read from the config at base, never the applied commit's own. */
-    approval?: Approval;
+    /** What counts as a waiting wave's approval; see APPROVALS, or a map with the mode and `require_signed` (ApprovalSettings). Read from the config at base, never the applied commit's own. */
+    approval?: Approval | ApprovalSettings;
     /** When a change applies; see ApplySettings. */
     apply?: ApplySettings;
     /** When a pull request takes its root locks; see LOCKS. */
@@ -534,6 +550,7 @@ export interface ProjectSettings {
     agent?: {
         via: (typeof AGENT_VIA)[number];
         token_env: string;
+        login?: string;
         comment?: boolean | AgentCommentSettings;
         drift?: boolean | AgentCommentSettings;
     };
@@ -717,6 +734,17 @@ export declare const TOKEN_PROTECTION_KEYS: string[];
 export declare const COST_KEYS: string[];
 export declare const PASS_KEYS: string[];
 export declare const AGENT_KEYS: string[];
+/** A forge login, as `agent.login` takes it. */
+export declare const AGENT_LOGIN: RegExp;
+/**
+ * `config check`'s warning when `agent.token_env` is set without
+ * `agent.login`: a pull request's author can use the agent's secret to post a
+ * review as the agent's account, and without its login nothing excludes it.
+ */
+export declare function agentLoginWarning(agent: {
+    token_env?: unknown;
+    login?: unknown;
+} | undefined): string | undefined;
 export declare const MODULES_KEYS: Set<string>;
 export declare const REGISTRY_KEYS: string[];
 /** A registry namespace or module name, as the Terraform module registry protocol allows them. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/terragucci",
-  "version": "0.4.12",
+  "version": "0.4.13",
   "description": "The whole Terraform lifecycle, handled: one config file, generated pipelines for GitHub, GitLab and Forgejo.",
   "license": "Apache-2.0",
   "type": "module",